OCTOBER-REVIEW-REVISIONS 8: the docs follow the code #53

Documentation brought in line with the code, with no test or pin changed. SANDBOX.md's diagram shows the front server's one render child, a single kind of request socket, no child-routes socket, iroh on the admin thread, and the wake-up and every direct call through on_main; its table of what crosses gains "reaches" and "its principal, assigned by" for each frame kind (only ToSite::Connection and ToSite::Admin carry a principal, set once by the front server). Its prose follows the code (the admin thread's pushes, the git-remote-pds folder, no admin-thread git reading the site's .git, the backup's children). docs/SECURITY.md drops the internal group, states the one principal assigned once, that publish build and end are direct calls, and that PDS remotes go by DID.

---

OCTOBER-REVIEW-REVISIONS, subunit 8. Plan: https://tangled.org/notplants-bot.bsky.social/lichen-orchestrator/blob/main/machine-docs/plans/OCTOBER-REVIEW-REVISIONS-2026-10-28.md

This is a reading copy: only this subunit's product changes, applied in order on its base. Nothing here is to be merged.

Source PRs on lichen.page.review (product), in order, with their original descriptions #

• #3423 s/792-orr-u8-docs — ORR 8: SANDBOX.md and docs/SECURITY.md follow the code; ORR's stale comments

  OCTOBER-REVIEW-REVISIONS unit 8, the docs (section E), and the stale comments ORR left. One PR: no test or pin changed, so there is no tests PR.

  • SANDBOX.md's diagram:
    • the front server's one child, the render child (front_render_spec), with the operator's note that its sandbox "is not strictly necessary": defence in depth, kept because it costs little;
    • one kind of request socket;
    • no child-routes socket;
    • iroh on the admin thread;
    • the wake-up (git::hub::Wake) and every direct call through on_main.
  • SANDBOX.md's table of what crosses: each frame kind gains "reaches" and "its principal, assigned by". Only ToSite::Connection and ToSite::Admin carry a principal. The front server sets it once, and the site believes it only on a connection passed on its control channel. ToSite::Admin's row was stale: it also carries clients' git, the editor's git panel and a publish.
  • SANDBOX.md prose follows the code: the admin thread's pushes, the git-remote-pds folder, no admin-thread git reading the site's .git, the backup's children. A bullet citing a deleted test is rewritten.
  • docs/SECURITY.md:
    • the internal group is gone (2c);
    • A4's one principal, assigned once;
    • publish build and end are direct calls;
    • PDS remotes go by DID (C3/R6);
    • two older errors fixed (the allowance file's location, a "front check before a push" that does not exist).
    • The generated principal tables already followed B3 and A3: regenerated, they are byte-identical.
  • docs/SITE-CONCURRENCY-MODEL.md C083 and C053 describe the one runtime slot (C4). AGENTS.md's test-layout rule matches D5 and its structure test.
  • Stale comments (1d31954a, comments only but one assert message and one reason string; a script shows no code line changed):
    • ipc/identity.rs's Origin doc;
    • admin_router's doc and forward_admin's doc and dead_code reason;
    • workspace_structure's acts::asks docs and :1749's message;
    • spawns.rs:84's reaper path;
    • lichen-cli site_process_tests.rs:2836 (5b's note). (…cut here; the full text is on the PR page.)

Commits #

• 116b72282 ORR 8: orr-u8-docs (#3423)

Count and shas #

count-product-code-lines 4a1a47150275..116b72282949: NET +0 · counted +2 -2 · moved out of the counted set +0 · comment-only deletions flagged 11 · macros flagged 0 · tests-folder code flagged 0

Base 4a1a471502755cfe56ea8a329fd05e6d41ac8a2d (tip of s/791-orr-u7-renames-tests). Head 116b72282949a27641b642f600262f6b6b7b680c. 11 files changed.

Check #

Every changed file is a file one of the product PRs changed, and each is identical at the head to the same file at the last product branch s/792-orr-u8-docs.